security-mcp 1.0.4 → 1.1.0

package/dist/gate/checks/playbook.js

@@ -0,0 +1,160 @@
+/**
+ * IR Playbook enforcement checks.
+ * Verifies incident response playbooks exist and contain required sections.
+ */
+import { stat } from "node:fs/promises";
+import { join } from "node:path";
+import fg from "fast-glob";
+import { readFileSafe } from "../../repo/fs.js";
+const PLAYBOOK_BASE = "security/playbooks";
+const REQUIRED_PLAYBOOKS = [
+    { surface: "web", path: "web-compromise.md", description: "Web compromise" },
+    { surface: "api", path: "api-compromise.md", description: "API compromise" },
+    { surface: "ai", path: "llm-prompt-injection.md", description: "LLM prompt injection" },
+    { surface: "ai", path: "model-data-poisoning.md", description: "Model data poisoning" },
+    { surface: "infra", path: "cloud-misconfiguration.md", description: "Cloud misconfiguration" },
+    { surface: "infra", path: "ransomware.md", description: "Ransomware" },
+    { surface: "mobileIos", path: "mobile-credential-theft.md", description: "Mobile credential theft" },
+    { surface: "mobileAndroid", path: "mobile-credential-theft.md", description: "Mobile credential theft" },
+    { surface: "payments", path: "payment-fraud.md", description: "Payment fraud" },
+    { surface: "payments", path: "pci-breach.md", description: "PCI breach" }
+];
+const REQUIRED_SECTIONS = [
+    { key: "detection", patterns: [/detection criteria/i, /how to detect/i, /indicators of compromise/i, /detection/i] },
+    { key: "escalation", patterns: [/escalation/i, /incident commander/i, /security lead/i, /on-call/i] },
+    { key: "containment", patterns: [/containment/i, /contain/i, /isolat/i] },
+    { key: "eradication", patterns: [/eradication/i, /eradicate/i, /root cause/i] },
+    { key: "recovery", patterns: [/recovery/i, /restore/i, /recover/i] },
+    { key: "communication", patterns: [/communication/i, /notification/i, /stakeholder/i, /template/i] },
+    { key: "post-incident", patterns: [/post.incident/i, /lessons learned/i, /review/i, /retrospective/i] },
+    { key: "mttd-mttr", patterns: [/mttd|mttr|mean time/i, /target.{0,30}time/i, /response time/i] }
+];
+const STALE_THRESHOLD_MS = 180 * 24 * 60 * 60 * 1000; // 180 days
+function surfaceActive(surface, surfaces, activeSurfaces) {
+    if (surface === "payments")
+        return activeSurfaces.has("payments");
+    if (surface === "mobileIos")
+        return surfaces.mobileIos;
+    if (surface === "mobileAndroid")
+        return surfaces.mobileAndroid;
+    return surfaces[surface] === true;
+}
+async function validatePlaybook(playbookPath) {
+    const missingSections = [];
+    let content = "";
+    let isStale = false;
+    try {
+        content = await readFileSafe(playbookPath);
+    }
+    catch {
+        return { missingSections: REQUIRED_SECTIONS.map((s) => s.key), isStale: false };
+    }
+    for (const section of REQUIRED_SECTIONS) {
+        const found = section.patterns.some((pattern) => pattern.test(content));
+        if (!found) {
+            missingSections.push(section.key);
+        }
+    }
+    try {
+        const s = await stat(playbookPath);
+        if (Date.now() - s.mtimeMs > STALE_THRESHOLD_MS) {
+            isStale = true;
+        }
+    }
+    catch { /* ignore */ }
+    return { missingSections, isStale };
+}
+/**
+ * Checks that IR playbooks exist and contain required sections for active surfaces.
+ */
+export async function runPlaybookChecks(opts) {
+    const findings = [];
+    // Detect if payments surface is active via file patterns
+    const activeSurfaces = new Set();
+    const paymentPatterns = /payment|stripe|braintree|adyen|checkout|pci/i;
+    if (opts.changedFiles.some((f) => paymentPatterns.test(f))) {
+        activeSurfaces.add("payments");
+    }
+    // Also scan repo for payment references
+    try {
+        const paymentFiles = await fg(["**/payment*.ts", "**/stripe*.ts", "**/checkout*.ts"], {
+            dot: true,
+            ignore: ["**/node_modules/**", "**/dist/**"]
+        });
+        if (paymentFiles.length > 0)
+            activeSurfaces.add("payments");
+    }
+    catch { /* ignore */ }
+    // Deduplicate required playbooks per surface
+    const checked = new Set();
+    for (const req of REQUIRED_PLAYBOOKS) {
+        if (!surfaceActive(req.surface, opts.surfaces, activeSurfaces))
+            continue;
+        const playbookPath = join(PLAYBOOK_BASE, req.path);
+        if (checked.has(playbookPath))
+            continue;
+        checked.add(playbookPath);
+        // Check if playbook exists
+        let exists = false;
+        try {
+            const matches = await fg([playbookPath], { dot: true });
+            exists = matches.length > 0;
+        }
+        catch { /* ignore */ }
+        if (!exists) {
+            findings.push({
+                id: "IR_PLAYBOOK_MISSING",
+                title: `IR playbook missing: ${req.description} (${playbookPath})`,
+                severity: "HIGH",
+                evidence: [`Expected path: ${playbookPath}`, `Surface: ${req.surface}`],
+                requiredActions: [
+                    `Create the IR playbook at ${playbookPath}.`,
+                    "Include all required sections: detection criteria, escalation path, containment, eradication, recovery, communication, post-incident review, and MTTD/MTTR targets."
+                ]
+            });
+            continue;
+        }
+        const { missingSections, isStale } = await validatePlaybook(playbookPath);
+        if (missingSections.length > 0) {
+            findings.push({
+                id: "IR_PLAYBOOK_INCOMPLETE",
+                title: `IR playbook incomplete: ${playbookPath}`,
+                severity: "MEDIUM",
+                evidence: [`Missing sections: ${missingSections.join(", ")}`, `Path: ${playbookPath}`],
+                requiredActions: [
+                    `Add the missing sections to ${playbookPath}: ${missingSections.join(", ")}.`,
+                    "Ensure each section has actionable steps, not just headers."
+                ]
+            });
+        }
+        if (isStale) {
+            findings.push({
+                id: "IR_PLAYBOOK_STALE",
+                title: `IR playbook not updated in 180+ days: ${playbookPath}`,
+                severity: "LOW",
+                evidence: [`Path: ${playbookPath}`],
+                requiredActions: [
+                    `Review and update ${playbookPath} to reflect current infrastructure and contacts.`,
+                    "Schedule quarterly playbook reviews."
+                ]
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Validate a single playbook file and return missing sections.
+ */
+export async function validateSinglePlaybook(playbookPath) {
+    let exists = false;
+    try {
+        const matches = await fg([playbookPath], { dot: true });
+        exists = matches.length > 0;
+    }
+    catch { /* ignore */ }
+    if (!exists) {
+        return { path: playbookPath, exists: false, missingSections: REQUIRED_SECTIONS.map((s) => s.key), isStale: false };
+    }
+    const { missingSections, isStale } = await validatePlaybook(playbookPath);
+    return { path: playbookPath, exists: true, missingSections, isStale };
+}

package/dist/gate/checks/runtime.js

@@ -0,0 +1,263 @@
+/**
+ * Runtime evidence verification.
+ * Checks HTTP security headers and TLS configuration against a live target.
+ */
+import * as https from "node:https";
+import * as tls from "node:tls";
+const REQUIRED_HEADERS = [
+    {
+        name: "content-security-policy",
+        findingId: "RUNTIME_HEADER_MISSING",
+        validate: (v) => {
+            if (/unsafe-inline|unsafe-eval/i.test(v)) {
+                return { ok: false, findingId: "RUNTIME_HEADER_UNSAFE", detail: "CSP contains unsafe-inline or unsafe-eval" };
+            }
+            return { ok: true };
+        }
+    },
+    {
+        name: "strict-transport-security",
+        findingId: "RUNTIME_HEADER_MISSING",
+        validate: (v) => {
+            const match = /max-age=(\d+)/i.exec(v);
+            const maxAge = match ? parseInt(match[1], 10) : 0;
+            if (maxAge < 31536000) {
+                return { ok: false, findingId: "RUNTIME_HEADER_UNSAFE", detail: `HSTS max-age ${maxAge} is below minimum 31536000` };
+            }
+            return { ok: true };
+        }
+    },
+    {
+        name: "x-frame-options",
+        findingId: "RUNTIME_HEADER_MISSING",
+        validate: (v) => {
+            if (!/^(deny|sameorigin)$/i.test(v.trim())) {
+                return { ok: false, findingId: "RUNTIME_HEADER_UNSAFE", detail: `X-Frame-Options value '${v}' is not DENY or SAMEORIGIN` };
+            }
+            return { ok: true };
+        }
+    },
+    { name: "x-content-type-options", findingId: "RUNTIME_HEADER_MISSING" },
+    { name: "referrer-policy", findingId: "RUNTIME_HEADER_MISSING" },
+    { name: "permissions-policy", findingId: "RUNTIME_HEADER_MISSING" }
+];
+const WEAK_CIPHERS = [
+    "RC4", "DES", "3DES", "NULL", "EXPORT", "ADH", "AECDH", "aNULL", "eNULL"
+];
+async function fetchHeaders(url, timeoutMs) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => resolve(null), timeoutMs);
+        try {
+            const parsedUrl = new URL(url);
+            const options = {
+                hostname: parsedUrl.hostname,
+                port: parsedUrl.port || 443,
+                path: parsedUrl.pathname || "/",
+                method: "HEAD",
+                rejectUnauthorized: false, // we verify cert separately
+                timeout: timeoutMs
+            };
+            const req = https.request(options, (res) => {
+                clearTimeout(timer);
+                const headers = {};
+                for (const [k, v] of Object.entries(res.headers)) {
+                    if (typeof v === "string")
+                        headers[k.toLowerCase()] = v;
+                    else if (Array.isArray(v))
+                        headers[k.toLowerCase()] = v.join(", ");
+                }
+                res.resume();
+                resolve(headers);
+            });
+            req.on("error", () => { clearTimeout(timer); resolve(null); });
+            req.on("timeout", () => { req.destroy(); clearTimeout(timer); resolve(null); });
+            req.end();
+        }
+        catch {
+            clearTimeout(timer);
+            resolve(null);
+        }
+    });
+}
+async function checkTls(hostname, port, timeoutMs) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => resolve(null), timeoutMs);
+        try {
+            const socket = tls.connect({ host: hostname, port, rejectUnauthorized: false, timeout: timeoutMs }, () => {
+                clearTimeout(timer);
+                const proto = socket.getProtocol() ?? "";
+                const cipher = socket.getCipher();
+                const certDer = socket.getPeerCertificate(true);
+                let cert = null;
+                if (certDer) {
+                    const issuer = certDer.issuer ? JSON.stringify(certDer.issuer) : "";
+                    const subject = certDer.subject ? JSON.stringify(certDer.subject) : "";
+                    cert = {
+                        subject,
+                        issuer,
+                        validTo: certDer.valid_to ?? "",
+                        selfSigned: issuer !== "" && issuer === subject
+                    };
+                }
+                socket.destroy();
+                resolve({
+                    version: proto,
+                    cipher: cipher?.name ?? "",
+                    cert
+                });
+            });
+            socket.on("error", (err) => {
+                clearTimeout(timer);
+                resolve({ version: "", cipher: "", cert: null, error: err.message });
+            });
+            socket.on("timeout", () => {
+                socket.destroy();
+                clearTimeout(timer);
+                resolve(null);
+            });
+        }
+        catch {
+            clearTimeout(timer);
+            resolve(null);
+        }
+    });
+}
+/**
+ * Run HTTP header and TLS runtime checks against SECURITY_STAGING_URL or policy-provided targets.
+ */
+export async function runRuntimeChecks(opts) {
+    const findings = [];
+    // Determine target URL
+    const stagingUrl = process.env["SECURITY_STAGING_URL"];
+    const targets = stagingUrl ? [stagingUrl, ...opts.targets] : opts.targets;
+    const uniqueTargets = [...new Set(targets)].filter((t) => t.startsWith("http"));
+    if (uniqueTargets.length === 0)
+        return findings;
+    const timeoutMs = 15_000;
+    for (const targetUrl of uniqueTargets) {
+        let parsedUrl;
+        try {
+            parsedUrl = new URL(targetUrl);
+        }
+        catch {
+            continue;
+        }
+        // --- HTTP Header checks ---
+        const headers = await fetchHeaders(targetUrl, timeoutMs);
+        if (headers !== null) {
+            for (const headerDef of REQUIRED_HEADERS) {
+                const value = headers[headerDef.name];
+                if (!value) {
+                    findings.push({
+                        id: "RUNTIME_HEADER_MISSING",
+                        title: `Security header missing: ${headerDef.name} on ${targetUrl}`,
+                        severity: "HIGH",
+                        evidence: [`URL: ${targetUrl}`, `Missing header: ${headerDef.name}`],
+                        requiredActions: [
+                            `Add the '${headerDef.name}' response header to your application.`,
+                            "Verify headers are set for all routes including error pages."
+                        ]
+                    });
+                }
+                else if (headerDef.validate) {
+                    const check = headerDef.validate(value);
+                    if (!check.ok) {
+                        findings.push({
+                            id: check.findingId ?? "RUNTIME_HEADER_UNSAFE",
+                            title: check.detail ?? `Unsafe header value: ${headerDef.name} on ${targetUrl}`,
+                            severity: "HIGH",
+                            evidence: [`URL: ${targetUrl}`, `Header: ${headerDef.name}: ${value}`],
+                            requiredActions: [
+                                `Fix the '${headerDef.name}' header value.`,
+                                check.detail ?? "Review security header configuration."
+                            ]
+                        });
+                    }
+                }
+            }
+        }
+        // --- TLS checks ---
+        if (parsedUrl.protocol === "https:") {
+            const port = parsedUrl.port ? parseInt(parsedUrl.port, 10) : 443;
+            const tlsResult = await checkTls(parsedUrl.hostname, port, timeoutMs);
+            if (tlsResult && !tlsResult.error) {
+                const proto = tlsResult.version.toUpperCase();
+                if (proto === "TLSV1" || proto === "TLSV1.0" || proto === "TLSV1.1" || proto === "SSLV3") {
+                    findings.push({
+                        id: "RUNTIME_TLS_WEAK",
+                        title: `Weak TLS version detected: ${tlsResult.version} on ${parsedUrl.hostname}`,
+                        severity: "CRITICAL",
+                        evidence: [`Host: ${parsedUrl.hostname}`, `TLS version: ${tlsResult.version}`],
+                        requiredActions: [
+                            "Disable TLS 1.0 and 1.1. Enforce TLS 1.2 minimum, TLS 1.3 preferred.",
+                            "Update your server's SSL/TLS configuration."
+                        ]
+                    });
+                }
+                const cipherUpper = tlsResult.cipher.toUpperCase();
+                if (WEAK_CIPHERS.some((wc) => cipherUpper.includes(wc))) {
+                    findings.push({
+                        id: "RUNTIME_TLS_WEAK",
+                        title: `Weak cipher suite in use: ${tlsResult.cipher} on ${parsedUrl.hostname}`,
+                        severity: "CRITICAL",
+                        evidence: [`Host: ${parsedUrl.hostname}`, `Cipher: ${tlsResult.cipher}`],
+                        requiredActions: [
+                            "Remove weak cipher suites from your TLS configuration.",
+                            "Use only ECDHE/DHE with AES-GCM or ChaCha20 cipher suites."
+                        ]
+                    });
+                }
+                if (tlsResult.cert) {
+                    const validTo = new Date(tlsResult.cert.validTo);
+                    const now = new Date();
+                    const daysRemaining = Math.floor((validTo.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));
+                    if (daysRemaining < 0) {
+                        findings.push({
+                            id: "RUNTIME_CERT_EXPIRED",
+                            title: `TLS certificate has expired on ${parsedUrl.hostname}`,
+                            severity: "CRITICAL",
+                            evidence: [
+                                `Host: ${parsedUrl.hostname}`,
+                                `Expired: ${tlsResult.cert.validTo}`,
+                                `Days overdue: ${Math.abs(daysRemaining)}`
+                            ],
+                            requiredActions: [
+                                "Renew the TLS certificate immediately.",
+                                "Set up certificate auto-renewal (e.g., Let's Encrypt with certbot)."
+                            ]
+                        });
+                    }
+                    else if (daysRemaining < 30) {
+                        findings.push({
+                            id: "RUNTIME_CERT_EXPIRING",
+                            title: `TLS certificate expiring in ${daysRemaining} days on ${parsedUrl.hostname}`,
+                            severity: "HIGH",
+                            evidence: [
+                                `Host: ${parsedUrl.hostname}`,
+                                `Expires: ${tlsResult.cert.validTo}`,
+                                `Days remaining: ${daysRemaining}`
+                            ],
+                            requiredActions: [
+                                "Renew the TLS certificate before it expires.",
+                                "Verify auto-renewal is configured and working."
+                            ]
+                        });
+                    }
+                    if (tlsResult.cert.selfSigned) {
+                        findings.push({
+                            id: "RUNTIME_TLS_WEAK",
+                            title: `Self-signed certificate detected on ${parsedUrl.hostname}`,
+                            severity: "CRITICAL",
+                            evidence: [`Host: ${parsedUrl.hostname}`, `Issuer: ${tlsResult.cert.issuer}`],
+                            requiredActions: [
+                                "Replace the self-signed certificate with one from a trusted CA.",
+                                "Use Let's Encrypt or your organization's PKI."
+                            ]
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return findings;
+}

package/dist/gate/checks/sbom.js

@@ -0,0 +1,199 @@
+/**
+ * SBOM generation and SLSA provenance checks.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdir, readFile, stat } from "node:fs/promises";
+import { join } from "node:path";
+import fg from "fast-glob";
+const execFileAsync = promisify(execFile);
+const SBOM_DIR = join(process.cwd(), ".mcp", "sbom");
+const ATTESTATION_DIR = join(process.cwd(), ".mcp", "attestations");
+const SBOM_PATH = join(SBOM_DIR, "latest.json");
+const SBOM_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+async function ensureDir(dir) {
+    try {
+        await mkdir(dir, { recursive: true });
+    }
+    catch { /* ignore */ }
+}
+async function commandExists(cmd) {
+    try {
+        await execFileAsync(cmd, ["version"], { timeout: 5000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function getSbomAge() {
+    try {
+        const s = await stat(SBOM_PATH);
+        return Date.now() - s.mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}
+async function readSbom() {
+    try {
+        const raw = await readFile(SBOM_PATH, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+async function getPackageJsonDeps() {
+    const manifests = await fg(["package.json", "**/package.json"], {
+        dot: true,
+        ignore: ["**/node_modules/**", "**/dist/**"]
+    });
+    const deps = [];
+    for (const manifest of manifests.slice(0, 5)) {
+        try {
+            const raw = await readFile(manifest, "utf-8");
+            const pkg = JSON.parse(raw);
+            const allDeps = {
+                ...(pkg["dependencies"] ?? {}),
+                ...(pkg["devDependencies"] ?? {})
+            };
+            deps.push(...Object.keys(allDeps));
+        }
+        catch { /* skip */ }
+    }
+    return [...new Set(deps)];
+}
+async function hasAttestation() {
+    try {
+        const files = await fg(["**/*.sig", "**/*.bundle", "**/*.att"], {
+            cwd: ATTESTATION_DIR,
+            dot: true
+        });
+        return files.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Run SBOM and SLSA provenance checks.
+ */
+export async function runSbomChecks(_opts) {
+    const findings = [];
+    await ensureDir(SBOM_DIR);
+    await ensureDir(ATTESTATION_DIR);
+    const syftAvailable = await commandExists("syft");
+    const cosignAvailable = await commandExists("cosign");
+    const autoSbom = process.env["SECURITY_AUTO_SBOM"] === "true";
+    const sbomAge = await getSbomAge();
+    // Auto-generate SBOM if enabled and Syft is available
+    if (autoSbom && syftAvailable && (sbomAge === null || sbomAge > SBOM_MAX_AGE_MS)) {
+        try {
+            await execFileAsync("syft", [".", `-o`, `cyclonedx-json=${SBOM_PATH}`], { cwd: process.cwd(), timeout: 120_000, maxBuffer: 50 * 1024 * 1024 });
+        }
+        catch (err) {
+            findings.push({
+                id: "SBOM_MISSING",
+                title: "SBOM generation failed",
+                severity: "HIGH",
+                evidence: [String(err)],
+                requiredActions: [
+                    "Investigate Syft installation and run it manually: syft . -o cyclonedx-json=.mcp/sbom/latest.json",
+                    "Ensure the .mcp/sbom/ directory is writable."
+                ]
+            });
+        }
+    }
+    // Re-check age after potential generation
+    const currentSbomAge = await getSbomAge();
+    if (currentSbomAge === null) {
+        if (syftAvailable) {
+            findings.push({
+                id: "SBOM_MISSING",
+                title: "No SBOM found. Syft is available — run it to generate one.",
+                severity: "HIGH",
+                evidence: [`Expected at: ${SBOM_PATH}`],
+                requiredActions: [
+                    "Run: syft . -o cyclonedx-json=.mcp/sbom/latest.json",
+                    "Or set SECURITY_AUTO_SBOM=true to auto-generate on each gate run."
+                ]
+            });
+        }
+        // If syft not available, skip SBOM checks gracefully
+    }
+    else {
+        if (currentSbomAge > SBOM_MAX_AGE_MS) {
+            findings.push({
+                id: "SBOM_STALE",
+                title: "SBOM is stale (older than 24 hours)",
+                severity: "MEDIUM",
+                evidence: [`SBOM age: ${Math.round(currentSbomAge / 3600000)}h`, `Path: ${SBOM_PATH}`],
+                requiredActions: [
+                    "Regenerate the SBOM: syft . -o cyclonedx-json=.mcp/sbom/latest.json",
+                    "Or set SECURITY_AUTO_SBOM=true to auto-regenerate."
+                ]
+            });
+        }
+        // Check cosign attestation
+        if (!cosignAvailable) {
+            // Skip cosign checks gracefully
+        }
+        else {
+            const attested = await hasAttestation();
+            if (!attested) {
+                findings.push({
+                    id: "SBOM_UNSIGNED",
+                    title: "SBOM exists but no cosign attestation found",
+                    severity: "MEDIUM",
+                    evidence: [`Attestation dir: ${ATTESTATION_DIR}`],
+                    requiredActions: [
+                        "Sign the SBOM with cosign: cosign attest --predicate .mcp/sbom/latest.json ...",
+                        "Store attestation in .mcp/attestations/"
+                    ]
+                });
+            }
+        }
+        // Cross-reference package.json deps vs SBOM components
+        const sbom = await readSbom();
+        if (sbom) {
+            const pkgDeps = await getPackageJsonDeps();
+            const sbomNames = new Set((sbom.components ?? []).map((c) => c.name?.toLowerCase() ?? ""));
+            const missing = pkgDeps.filter((dep) => !sbomNames.has(dep.toLowerCase())).slice(0, 20);
+            if (missing.length > 0) {
+                findings.push({
+                    id: "SBOM_COMPONENT_MISMATCH",
+                    title: "Dependencies in package.json not found in SBOM",
+                    severity: "HIGH",
+                    evidence: missing,
+                    requiredActions: [
+                        "Regenerate the SBOM to include all current dependencies.",
+                        "Ensure Syft has access to node_modules when generating the SBOM."
+                    ]
+                });
+            }
+        }
+    }
+    // SLSA provenance check
+    try {
+        const provenanceFiles = await fg(["**/*.intoto.jsonl", "**/provenance.json", "**/*.provenance"], {
+            cwd: ATTESTATION_DIR,
+            dot: true
+        });
+        if (provenanceFiles.length === 0) {
+            findings.push({
+                id: "PROVENANCE_MISSING",
+                title: "No SLSA provenance attestation found",
+                severity: "HIGH",
+                evidence: [`Attestation dir: ${ATTESTATION_DIR}`],
+                requiredActions: [
+                    "Generate SLSA provenance during CI/CD build.",
+                    "Use slsa-github-generator or equivalent to produce .intoto.jsonl attestations.",
+                    "Store provenance in .mcp/attestations/"
+                ]
+            });
+        }
+    }
+    catch { /* directory doesn't exist yet */ }
+    return findings;
+}